Mandiant

Mandiant Releases Tools to Combat Net-NTLMv1 Protocol Vulnerabilities

First seen 19 Jan 2026, 03:57 UTC • Mandiant

•85% similarity •37.6

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Mandiant has released rainbow tables that can crack credentials using the Net-NTLMv1 protocol within 12 hours. This legacy Microsoft authentication protocol has been known to expose users to credential theft for over 20 years, yet it remains in use in many organizations. The release aims to encourage migration away from this outdated and insecure protocol.

ThreatCluster AI

Attack Flow

24 entities, 43 inferred relationships (STIX 2.1).

Threat Actor (1)

Ta577

Technique (5)

Brute Force
Phishing
NTLM Relay
Pass The Hash
T1003.006 - DCSync

Organization (1)

US Supreme Court

Vulnerability (2)

CVE-2025-54918
Net-NTLMv1

Affected Platform (3)

Public Access To Court Electronic Records (pacer) System
Active Directory
Windows

Tool (12)

DFSCoerce
Gsutil
Hashcat
Impacket
Net-NTLMv1 Rainbow Table
Ntlmv1-multi
PetitPotam
RainbowCrack
RainbowCrack-NG
Rainbow Tables
Responder
Secretsdump.py

Relationships

Ta577 uses DFSCoerce
Ta577 uses Gsutil
Ta577 uses Hashcat
Ta577 uses Impacket
Ta577 uses Net-NTLMv1 Rainbow Table
Ta577 uses Brute Force
Ta577 uses Phishing
Ta577 uses NTLM Relay
Ta577 uses Pass The Hash
Ta577 uses T1003.006 - DCSync
Ta577 exploits CVE-2025-54918
Ta577 exploits Net-NTLMv1
DFSCoerce exploits CVE-2025-54918
DFSCoerce exploits Net-NTLMv1
Gsutil exploits CVE-2025-54918
Gsutil exploits Net-NTLMv1
Hashcat exploits CVE-2025-54918
Hashcat exploits Net-NTLMv1
Impacket exploits CVE-2025-54918
Impacket exploits Net-NTLMv1
Net-NTLMv1 Rainbow Table exploits CVE-2025-54918
Net-NTLMv1 Rainbow Table exploits Net-NTLMv1
Ntlmv1-multi exploits CVE-2025-54918
Ntlmv1-multi exploits Net-NTLMv1
PetitPotam exploits CVE-2025-54918
PetitPotam exploits Net-NTLMv1
RainbowCrack exploits CVE-2025-54918
RainbowCrack exploits Net-NTLMv1
RainbowCrack-NG exploits CVE-2025-54918
RainbowCrack-NG exploits Net-NTLMv1
Rainbow Tables exploits CVE-2025-54918
Rainbow Tables exploits Net-NTLMv1
Responder exploits CVE-2025-54918
Responder exploits Net-NTLMv1
Secretsdump.py exploits CVE-2025-54918
Secretsdump.py exploits Net-NTLMv1
CVE-2025-54918 targets Public Access To Court Electronic Records (pacer) System
CVE-2025-54918 targets Active Directory
CVE-2025-54918 targets Windows
Net-NTLMv1 targets Public Access To Court Electronic Records (pacer) System
Net-NTLMv1 targets Active Directory
Net-NTLMv1 targets Windows
Ta577 targets US Supreme Court

Community

Browse all →

Mandiant Releases Tools to Combat Net-NTLMv1 Protocol Vulnerabilities

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading